Oracle Database Options and Packs – The risks and what to do about it

Over the years Oracle Database technology has evolved with new features being added on a regular basis. These features have become products in their own right and are divided into Oracle Database Options and Oracle Database Management Packs (Options and Packs). These Options and Packs have an additional license cost and their license metric matches that of the database, typically core based. Many of these Options and Packs can be extremely expensive especially when deployed on a multi-core architecture such as a virtual host or cluster. The challenge for organizations is that Oracle provides no barrier to installing Options and Packs and in fact they are installed by default during a standard Database installation.

Options and Packs Installed verses In-use

Oracles argue that they wish to make all their products available to users and easy to install and that they can be easily unselected during install or removed later. They also make the point that you only have to license (pay for) products that are in-use. The problem is that it now becomes the responsibility of your organization to prove that the Oracle products are not in-use which is not a trivial task. The only way to determine with certainty that Options and Packs are in-use or just installed is to run queries on every database in your network. Oracle do not accept the results of their own management suite Oracle Enterprise Manager which gives you some idea of how complex this task is. Even using scripts this is a very time-consuming process and needs to be carried out frequently to ensure no new Options and Packs have been installed without your knowledge. You also have the risk that a database using particular Options and Packs has been moved to hardware that has more cores, the typical license metric for database products. Given that most organizations have virtualized their servers this is a very real risk and can create a huge compliance risk, running into the millions.

When Options and Packs are not really In-use

To make it even more difficult for organizations to determine if particular Options and Packs are in-use it is common for Oracle itself to “use” an option to support another product. Examples would be Advanced Compression (AC) or Advanced Security (AS) which are used by several products if they are found installed. It is also common for database patches to inadvertently use Options and Packs if they are found installed. The onus again is with your organization to prove that it was not your DBA’s who used the product. Even the check for system users will not always be enough when dealing with an audit.

Staying Compliant

To avoiding a compliance risk with Oracle Database Options and Packs here are a few checks that will help.

1. Avoid default installs of Oracle database products
2. Carry out quarterly checks on all databases to verify that all options and packs are approved and have sufficient licenses assigned
3. Add a task to your database health checks to report any options and packs not in-use for possible removal

Are you confident you know which Oracle database in your organization have Options and Packs installed? If not we can help you quickly find out, even on very large networks. Contact us to find out how

Reference

Oracle Database Editions and Options explained Oracle Database Options Abbreviations Oracle Audit Scripts